Skip to content

Commit b952e95

Browse files
markgoddardmarkgoddard
committed
Add default firewall configuration
This is a working configuration from a deployment. It needs to be generalised in order to work on other deployments.
1 parent 0347257 commit b952e95

File tree

8 files changed

+218
-16
lines changed

8 files changed

+218
-16
lines changed

‎etc/kayobe/compute.yml‎

Lines changed: 22 additions & 4 deletions
Original file line numberDiff line numberDiff line change
@@ -125,23 +125,41 @@
125125
###############################################################################
126126
# Compute node firewalld configuration.
127127

128+
# FIXME: Replace concrete names (provision_oc) with abstract net names ({{
129+
# provision_oc_net_name }}).
130+
128131
# Whether to install and enable firewalld.
129-
#compute_firewalld_enabled:
132+
compute_firewalld_enabled: true
130133

131134
# A list of zones to create. Each item is a dict containing a 'zone' item.
132-
#compute_firewalld_zones:
135+
compute_firewalld_zones:
136+
- zone: provision_oc
137+
- zone: storage
138+
- zone: tunnel
133139

134140
# A firewalld zone to set as the default. Default is unset, in which case the
135141
# default zone will not be changed.
136-
#compute_firewalld_default_zone:
142+
# FIXME: Try setting to drop
143+
compute_firewalld_default_zone: trusted
137144

138145
# A list of firewall rules to apply. Each item is a dict containing arguments
139146
# to pass to the firewalld module. Arguments are omitted if not provided, with
140147
# the following exceptions:
141148
# - offline: true
142149
# - permanent: true
143150
# - state: enabled
144-
#compute_firewalld_rules:
151+
compute_firewalld_rules:
152+
- service: ssh
153+
zone: provision_oc
154+
- service: dhcpv6-client
155+
state: disabled
156+
zone: public
157+
- service: ssh
158+
state: disabled
159+
zone: public
160+
# GENEVE
161+
- port: 6081/udp
162+
zone: tunnel
145163

146164
###############################################################################
147165
# Compute node host libvirt configuration.

‎etc/kayobe/controllers.yml‎

Lines changed: 47 additions & 4 deletions
Original file line numberDiff line numberDiff line change
@@ -134,23 +134,66 @@
134134
###############################################################################
135135
# Controller node firewalld configuration.
136136

137+
# FIXME: Replace concrete names (provision_oc) with abstract net names ({{
138+
# provision_oc_net_name }}).
139+
137140
# Whether to install and enable firewalld.
138-
#controller_firewalld_enabled:
141+
# FIXME: Disable by default?
142+
controller_firewalld_enabled: true
139143

140144
# A list of zones to create. Each item is a dict containing a 'zone' item.
141-
#controller_firewalld_zones:
145+
# FIXME: Filter out duplicates and unset networks?
146+
controller_firewalld_zones:
147+
- zone: external
148+
- zone: mgmt_wl
149+
- zone: provision_oc
150+
- zone: provision_wl
151+
- zone: public
152+
- zone: storage
153+
- zone: tunnel
142154

143155
# A firewalld zone to set as the default. Default is unset, in which case the
144156
# default zone will not be changed.
145-
#controller_firewalld_default_zone:
157+
# FIXME: Try setting to drop
158+
controller_firewalld_default_zone: trusted
146159

147160
# A list of firewall rules to apply. Each item is a dict containing arguments
148161
# to pass to the firewalld module. Arguments are omitted if not provided, with
149162
# the following exceptions:
150163
# - offline: true
151164
# - permanent: true
152165
# - state: enabled
153-
#controller_firewalld_rules:
166+
# FIXME: Add all services, add conditionals, filter out unused
167+
controller_firewalld_rules:
168+
- service: ssh
169+
zone: provision_oc
170+
- service: dhcp
171+
zone: provision_wl
172+
- service: ntp
173+
zone: provision_wl
174+
- service: tftp
175+
zone: provision_wl
176+
- port: 8089/tcp
177+
zone: provision_wl
178+
- service: dhcpv6-client
179+
state: disabled
180+
zone: public
181+
- service: ssh
182+
state: disabled
183+
zone: public
184+
# Designate
185+
- port: 53/tcp
186+
zone: public
187+
- port: 53/udp
188+
zone: public
189+
# Designate AXFR
190+
- port: 5354/tcp
191+
zone: public
192+
- port: 5354/udp
193+
zone: public
194+
# GENEVE
195+
- port: 6081/udp
196+
zone: tunnel
154197

155198
###############################################################################
156199
# Controller node swap configuration.

‎etc/kayobe/inventory/group_vars/ansible-control/infra-vm‎

Lines changed: 33 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,33 @@
1+
---
2+
###############################################################################
3+
# Infrastructure VM node firewalld configuration.
4+
5+
# FIXME: Replace concrete names (provision_oc) with abstract net names ({{
6+
# provision_oc_net_name }}).
7+
8+
# Whether to install and enable firewalld.
9+
infra_vm_firewalld_enabled: true
10+
11+
# A list of zones to create. Each item is a dict containing a 'zone' item.
12+
infra_vm_firewalld_zones:
13+
- zone: mgmt_oc
14+
- zone: mgmt_wl
15+
- zone: provision_oc
16+
- zone: public
17+
- zone: switch_mgmt
18+
19+
# A firewalld zone to set as the default. Default is unset, in which case the
20+
# default zone will not be changed.
21+
infra_vm_firewalld_default_zone: drop
22+
23+
# A list of firewall rules to apply. Each item is a dict containing arguments
24+
# to pass to the firewalld module. Arguments are omitted if not provided, with
25+
# the following exceptions:
26+
# - offline: true
27+
# - permanent: true
28+
# - state: enabled
29+
infra_vm_firewalld_rules:
30+
- service: ssh
31+
zone: provision_oc
32+
- service: ssh
33+
zone: switch_mgmt

‎etc/kayobe/inventory/group_vars/wazuh-manager/infra-vm‎

Lines changed: 43 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,43 @@
1+
---
2+
###############################################################################
3+
# Infrastructure VM node firewalld configuration.
4+
5+
# FIXME: Replace concrete names (provision_oc) with abstract net names ({{
6+
# provision_oc_net_name }}).
7+
8+
# Whether to install and enable firewalld.
9+
infra_vm_firewalld_enabled: true
10+
11+
# A list of zones to create. Each item is a dict containing a 'zone' item.
12+
infra_vm_firewalld_zones:
13+
- zone: provision_oc
14+
- zone: public
15+
- zone: switch_mgmt
16+
17+
# A firewalld zone to set as the default. Default is unset, in which case the
18+
# default zone will not be changed.
19+
infra_vm_firewalld_default_zone: drop
20+
21+
# A list of firewall rules to apply. Each item is a dict containing arguments
22+
# to pass to the firewalld module. Arguments are omitted if not provided, with
23+
# the following exceptions:
24+
# - offline: true
25+
# - permanent: true
26+
# - state: enabled
27+
infra_vm_firewalld_rules:
28+
- service: ssh
29+
zone: provision_oc
30+
- port: 1514/tcp
31+
zone: provision_oc
32+
- port: 1514/udp
33+
zone: provision_oc
34+
- port: 1515/tcp
35+
zone: provision_oc
36+
- port: 443/tcp
37+
zone: public
38+
- port: 9200/tcp
39+
zone: provision_oc
40+
- port: 9300-9400/tcp
41+
zone: provision_oc
42+
- port: 55000/tcp
43+
zone: provision_oc

‎etc/kayobe/kolla/globals.yml‎

Lines changed: 3 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -49,3 +49,6 @@ prometheus_instance_label: "{% raw %}{{ ansible_facts.hostname }}{% endraw %}"
4949
# in Yoga. This is required to include a valid value for the flavor_id label on
5050
# openstack_nova_server_status metrics.
5151
prometheus_openstack_exporter_compute_api_version: "2.1"
52+
53+
# Open up ports in firewalld for services on the public API network.
54+
enable_external_api_firewalld: true

‎etc/kayobe/seed-hypervisor.yml‎

Lines changed: 2 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -117,6 +117,8 @@
117117
###############################################################################
118118
# Seed hypervisor node firewalld configuration.
119119

120+
# FIXME: Add some seed hypervisor rules?
121+
120122
# Whether to install and enable firewalld.
121123
#seed_hypervisor_firewalld_enabled:
122124

‎etc/kayobe/seed.yml‎

Lines changed: 45 additions & 4 deletions
Original file line numberDiff line numberDiff line change
@@ -155,23 +155,64 @@ seed_extra_containers: {}
155155
###############################################################################
156156
# Seed node firewalld configuration.
157157

158+
# FIXME: Replace concrete names (provision_oc) with abstract net names ({{
159+
# provision_oc_net_name }}).
160+
158161
# Whether to install and enable firewalld.
159-
#seed_firewalld_enabled:
162+
seed_firewalld_enabled: true
160163

161164
# A list of zones to create. Each item is a dict containing a 'zone' item.
162-
#seed_firewalld_zones:
165+
seed_firewalld_zones:
166+
- zone: mgmt_oc
167+
- zone: provision_oc
168+
- zone: public
169+
- zone: switch_mgmt
163170

164171
# A firewalld zone to set as the default. Default is unset, in which case the
165172
# default zone will not be changed.
166-
#seed_firewalld_default_zone:
173+
seed_firewalld_default_zone: drop
167174

168175
# A list of firewall rules to apply. Each item is a dict containing arguments
169176
# to pass to the firewalld module. Arguments are omitted if not provided, with
170177
# the following exceptions:
171178
# - offline: true
172179
# - permanent: true
173180
# - state: enabled
174-
#seed_firewalld_rules:
181+
seed_firewalld_rules:
182+
- service: ssh
183+
zone: provision_oc
184+
- service: dhcp
185+
zone: provision_oc
186+
- service: tftp
187+
zone: provision_oc
188+
- service: ntp
189+
zone: provision_oc
190+
- service: ntp
191+
zone: switch_mgmt
192+
# Pulp server
193+
- service: http
194+
zone: provision_oc
195+
- service: squid
196+
zone: provision_oc
197+
# Ironic inspector API
198+
- port: 5050/tcp
199+
zone: provision_oc
200+
# Ironic API
201+
- port: 6385/tcp
202+
zone: provision_oc
203+
# nginx
204+
- port: 8080/tcp
205+
zone: provision_oc
206+
# Disable default services in public zone
207+
- service: dhcpv6-client
208+
state: disabled
209+
zone: public
210+
- service: ssh
211+
state: disabled
212+
zone: public
213+
# Redfish exporter
214+
- port: 9610/tcp
215+
zone: provision_oc
175216

176217
###############################################################################
177218
# Seed node swap configuration.

‎etc/kayobe/storage.yml‎

Lines changed: 23 additions & 4 deletions
Original file line numberDiff line numberDiff line change
@@ -130,23 +130,42 @@
130130
###############################################################################
131131
# Storage node firewalld configuration.
132132

133+
# FIXME: Replace concrete names (provision_oc) with abstract net names ({{
134+
# provision_oc_net_name }}).
135+
133136
# Whether to install and enable firewalld.
134-
#storage_firewalld_enabled:
137+
storage_firewalld_enabled: true
135138

136139
# A list of zones to create. Each item is a dict containing a 'zone' item.
137-
#storage_firewalld_zones:
140+
storage_firewalld_zones:
141+
- zone: internal
142+
- zone: provision_oc
143+
- zone: storage
138144

139145
# A firewalld zone to set as the default. Default is unset, in which case the
140146
# default zone will not be changed.
141-
#storage_firewalld_default_zone:
147+
# FIXME: Try setting to drop
148+
storage_firewalld_default_zone: trusted
142149

143150
# A list of firewall rules to apply. Each item is a dict containing arguments
144151
# to pass to the firewalld module. Arguments are omitted if not provided, with
145152
# the following exceptions:
146153
# - offline: true
147154
# - permanent: true
148155
# - state: enabled
149-
#storage_firewalld_rules:
156+
storage_firewalld_rules:
157+
- service: ssh
158+
zone: provision_oc
159+
- port: 9283/tcp
160+
zone: provision_oc
161+
- service: ssh
162+
zone: storage
163+
state: disabled
164+
- service: ceph
165+
zone: storage
166+
- service: ceph-mon
167+
zone: storage
168+
state: "{{ 'enabled' if 'mons' in group_names else 'disabled' }}"
150169

151170
###############################################################################
152171
# Storage node swap configuration.

0 commit comments

Comments
 (0)